So, you wanna catch a macro virus ? Here, I'll show you a simple method of how to

  catch a macro virus and obtain the source code. After all, with sooo many macro

  viruses out there, it's pretty exciting if we get to catch one, and even those

  unknown and undetected ones. This trick would work on Word 97. I'm not sure if

  it works on Word 2000 coz I've never tested it on Word 2000. Also, don't bother

  trying it on Word XP/2002 coz it won't work.

First thing's first, what you'll need: an infected document (*.doc) and MS Word 97.

Getting started:

Make sure that you turn off any AV software coz it'll interfere with our tasks.

Also, before doing anything, ensure that the Macro Virus Protection feature in

  Word 97 is on (activated). This is extremely important as we'll see later.

First......run the infected document by double clicking it. This is where the

  Macro Virus Protection feature kicks in. If you have it disabled, our virulent

  macros will be activated and taa taa.......you've activated the virus and

  infected your Word environment. So, once again, I stress that you TURN ON

  the macro virus protection feature in Word 97.Next, when our alert warning

  prompts out, select Disable Macros. This would prevent all macros in the document

  from running and opens the document in ReadOnly mode. Don't worry.....of course

  the viral code won't be activated since you've disabled all macros.

After it's done and the document is opened, go to Tools-Macro-Visual Basic Editor.

This would launch the VB IDE. Double click ThisDocument.

And surprise.......you'll get to see the entire VBA code of the virus. If ThisDocument

is empty, find for any module within the project explorer window. This should

give the viral code of the doc. Also, if there are any forms, you can get to

view it too. There goes....my tutorial on catching a macro virus. This method

works even with unknown and undetected macro viruses.

Additional Tips & Tricks:

- To know whether your Word environment is infected by a macro virus, find for

  Normal.dot file in your harddisk. Note it's size. The normal size is 26k-27k

  (for Word 97). If the filesize is about this range, it's not infected.

  However, if it's way above this range for example 40K or 50K, then, there's a

  BIG possibility that it's infected.

- Also, when you get a large Normal.dot fiile, try viewing it in Notepad or a

Hex Editor. There's a chance that you could uncover viral code traces in clear text